NuGet's PrivateAssets="runtime" does not work, resulting in transitive
references local copying  their assemblies into every project. This
works around that by filtering out all local copies that are not
explictly listed.

This also makes it much harder to accidentally introduce local copies,
which is good as local copies in general are are not desirable due to
the way that dlls are loaded by the extension system.